Skip to main content

Cyware Orchestrate

Troubleshoot Cyware Agent Errors

This section is useful after a Cyware Agent installation to help analysts troubleshoot the related errors.

Verify Agent Connection After Restarting the Instance

  1. Ensure that the docker service is running on the instance. You can use the following command to verify the status of the docker service.

    sudo systemctl status docker

  2. If the docker service is not running, use the following command to start the docker service.

    sudo systemctl enable docker
sudo systemctl start docker
sudo chmod 777 /var/run/docker.sock
Check Permissions of Cyware Agent Mount Directory

You can use the commands provided in this section to verify the permissions for the Cyware Agent mount directory. The permissions are required for users to create new agents and upgrade agents in a specific mount directory.

Check the User ID of the Agent Mount Directory

The user ID should have 1000 permissions for the Cyware Agent mount directory to make changes. To check the user ID of the agent mount directory use the following command. Replace <path_to_agent_mount_directory> with the actual directory path.

stat -c '%u' <path_to_agent_mount_directory>

For example, stat -c '%u' /apps/cyware/new/prod_agent

The console should display 1000 as a response if you have permissions for the Cyware Agent mount directory.

Check the Group ID of the Agent Mount Directory

The group ID should have 1000 permissions for the Cyware Agent mount directory to make changes. To check the group ID of the agent mount directory, use the following command. Replace <path_to_agent_mount_directory> with the actual directory path.

stat -c '%g' <path_agent_mount_directory>

For example, stat -c '%g' /apps/cyware/new/prod_agent

The console should display 1000 as a response if you have permissions for the Cyware Agent mount directory.

Provide Permissions for Specific Mount Directory

To update permissions for the Cyware Agent mount directory, use the following command. Replace <path_to_agent_mount_directory> with the actual directory path.

chown -R 1000:1000 <path_to_agent_mount_directory>

For example, chown -R 1000:1000 /apps/cyware/new/prod_agent

Check Connectivity from Cyware Agent to Orchestrate

You can verify if the Cyware Agent instance can connect to Orchestrate by checking the logs in the /apps/logs folder $MOUNT_DIRECTORY. For example, /apps/cyware/cyware_agent/apps/logs/application.log and /apps/cyware/cyware_agent/apps/logs/error.log.

The $MOUNT_DIRECTORY can be different for every event installation. In the above example, MOUNT_DIRECTORY=/apps/cyware/cyware_agent

Steps to verify the connection

To check the connectivity from the Cyware Agent to Orchestrate, follow these steps.

  1. Run tail -f $MOUNT_DIRECTORY/apps/logs/application.log to check the application logs.

  2. You will see a response as shown below.

    2024-02-29 14:00:57,321 INFO TR-ID: MSG: Validating and Checking connectivity with https://cy.example.com/soarapi/openapi/ TRACEBACK:
2024-02-29 14:00:57,321 [INFO] app_log: Validating and Checking connectivity with https://cy.example.com/soarapi/openapi/
2024-02-29 14:00:57,365 [DEBUG] urllib3.connectionpool: Starting new HTTPS connection (1): cy.cyware.com:443
2024-02-29 14:00:58,382 [DEBUG] urllib3.connectionpool: https://cy.cyware.com:443 "GET /soarapi/openapi/v1/test_connectivity/
2024-02-29 14:00:58,411 INFO TR-ID: MSG: Api https://cy.cyware.com/soarapi/openapi/v1/test_connectivity/ GET - status_code: 200 TRACEBACK:
2024-02-29 14:00:58,411 [INFO] app_log: Api https://cy.cyware.com/soarapi/openapi/v1/test_connectivity/ GET - status_code: 200
2024-02-29 14:00:58,417 INFO TR-ID: MSG: Connection established! TRACEBACK:
2024-02-29 14:00:58,417 [INFO] app_log: Connection established!

  3. You can look for Connection Established or PUT - status_code: 200 to confirm the connectivity.

    Connection established!

OR 

(ignore [...] below.. you want to look at the end of the line)
app_log: Api https://[...]/orchestrate/abxd234-c4d5-4a3f-bb77-akdhbfiweb/ 
PUT - status_code: 200
Cyware Agent Common Errors

The following are the common errors that analysts can encounter with Cyware Agent and their corresponding troubleshooting steps. These common errors can be found in the application.log or error.log files. For more information on the default location of application.log and error.log files, see Default Directories.

Connection Error or Timeout Error

These errors denote the connectivity issue of Cyware Agent with Orchestrate instance or the apps that are hosted on-premise.

To validate these errors on the Orchestrate platform:

  1. Navigate to Admin Panel > Cyware Agent.

  2. Select a required Cyware Agent and check the Last Polled Time and Schedule.

You can also check if your admin has received a Cyware Agent failure email notification.

Cause:

  1. Incorrect configuration of proxy settings in the .env file

  2. The open API to access the Orchestrate instance is expired.

Resolution:

  1. Configure the proxy settings in the .env file. The default location of the .env file is /path/to/mount_directory/conf/.env.

  2. Update the expiry date of the Open API used to access the Orchestrate instance. To update the expiry date of Open API, see Troubleshoot Cyware Agent Errors on Playbook.

Not able to import packages for appname_ appversion (Example: virus_total_1_0_0)

This error occurs when Cyware Agent is unable to connect to Cyware's pypi repository (https://packages.cyware.com/repository/pypi-group/simple/) that hosts all the required python modules.

Cause:

  1. Incorrect value of PIP_PACKAGE_DOWNLOAD_PATH in the .env file.

  2. Connectivity failure to access the value of PIP_PACKAGE_DOWNLOAD_PATH in the .env file.

Resolution:

Execute the following command that validates the connectivity of Cyware Agent with the value of PIP_PACKAGE_DOWNLOAD_PATH defined in the .env file.

curl <PIP_PACKAGE_DOWNLOAD_PATH>

Note

The default value of PIP_PACKAGE_DOWNLOAD_PATH is https://packages.cyware.com/repository/pypi-group/simple/.

Connection between Cyware Agent and Cyware Orchestrate failed due to certificate error

If you have installed Cyware Agent with a custom CA certificate, this error occurs when the certificate expires or is invalid.

Resolution:

Update the certificate on the Cyware Agent host system and restart Cyware Agent. To restart Cyware Agent, run the following command:

bash configure.sh MOUNT_DIRECTORY=<new-mount-directory> IMAGE=<image-url> DOCKER_NAME=<docker_name> MODE=restart
Commands to Troubleshoot Cyware Agent Errors

This section describes the troubleshooting commands that analysts can use to troubleshoot Cyware Agent-related issues.

To check the activation status of Cyware Agent, execute the following command. The output displays the list of running docker containers.

docker ps

You can remove an existing docker container and start a new docker container while upgrading Cyware Agent from 1.x version to Cyware Agent 2.0 version. To remove or start a specific docker container, execute the following command.

  1. To remove a container:

    docker container rm -f <Container_Name>

  2. To start a container:

    docker run --env-file=<Agent_Mount_Directory>/conf/.env -v <Agent_Mount_Directory>/apps:/app/integrations/apps --name <Container_Name> -d --restart unless-stopped <Image_Name> agent

If you need to modify the polling schedule configured during installation, do the following :

  1. Navigate to the .env file.

  2. Update the cron expression, and restart the docker container.

To modify the proxy settings:

  1. Navigate to the .env file and update the http_proxy, https_proxy, or no_proxy settings.

  2. Restart the docker container.

To manually poll the Cyware Agent for troubleshooting, execute the following command:

docker exec -it cyware_agent python /app/cyware_agent/lite_agent.py
Troubleshoot Cyware Agent Errors on Playbook

Errors encountered for a Playbook node that is Cyware Agent compatible delays the process of Playbook execution. These errors may occur due to incorrect node configurations or network connectivity during Playbook creation or during its run time. It is important to analyze and fix these errors.

Cyware Agent related errors can occur in two situations:

  • During Playbook node configurations: Display errors while configuring a Playbook node that is compatible with Cyware Agent.

  • During Playbook execution: Displays errors related to Cyware Agent during Playbook execution.

Before you Start

  1. Ensure that you have permission to View Cyware Agent Configuration, Create/Update Cyware Agent Configuration, View Cyware Agent Tasks, Create/Update Cyware Agent Tasks, and View Run Logs. For more information about the required permissions to view Cyware Agent and run logs, contact your Administrator.